If it exhibits here only, then I have a gut feeling it is related to csrf-sync.
If NodeBB restarts, it could be that the valid csrf token is stored in memory and is lost 🤷
Edit: No... I just tested that locally and it worked fine. Hm.
Anyone else experiencing double posts on their forums? People presses "Submit" twice (or reloads page and opens compose window with the local-storage saved message). I've done it myself a couple of times. I think it can happen when the websocket disconnects.
A possible solution could be to generate a hidden unique in the the form which is matched when submiting.